The line between business continuity (BC) and disaster recovery (DR) may seem fuzzy, but there are important differences between the two. Here’s what you should know.
Business continuity (BC) and disaster recovery (DR) are often used in coordination with one another, or even interchangeably as terms. But they are two different things. With the pandemic making the importance of business continuity known, leaders should understand the key differences between BC and DR.
What is business continuity? The big picture
BC is a methodology that allows organizations to keep their business running in the event of a crisis and return to full functionality when the crisis ends. It’s a process of continuous improvement that reflects both internal and external operations, focusing on preserving the functionality of the overall business. This includes setting up preventative controls and managing employees and customers.
BC planning revolves around the actions your organization must take during and following an event to ensure that the business can function as usual. You need strategies in place, for example, to respond when resources such as equipment, workforce, workplace, third-party vendors, IT services, and data are unavailable.Business continuity plans detail the actions your organization must take during and following an event to ensure that the business can function as usual.
3 factors a business continuity strategy should address
BC planning must include all factors that are involved in normal business operations. Your response strategy must account for the following three key factors:
1. Communications
When a crisis occurs, communication with your employees, users, and shareholders is critical. Human resources (HR) plays a key role in ensuring active, consistent, and timely communication between your organization and the staff.
For external communications, social media is a vital tool to provide timely updates to outside stakeholders and users. When an incident arises, many users turn to social media first for acknowledgment and updates.
For example, if Netflix goes down, users won’t go to Netflix.com for information; they’ll head to Netflix’s social accounts. Take control of your message and have a plan in place for responding on social.
2. Workforce response
Workforce response is equally important in the event of a crisis. Your employees should know who to contact and what is expected from them – especially what to avoid doing. It’s your responsibility to keep your employees informed and educated on these matters.
As businesses grow and threats evolve, it’s critical for employees to be involved in the BC plan. Keep them updated about the event, your organization’s BC plan, and any changes in BC policies.
3. IT infrastructure recovery
BC planning also includes IT infrastructure recovery: How will you bring your IT systems back online following a disaster?
This is where DR comes into play. The recovery strategy typically involves the BC and IT teams working hand in hand.
What is disaster recovery? A subset of BC
Disaster recovery includes the backup systems and IT contingency methods for your organization’s critical functions and applications.
Disaster recovery, as part of an overall BC plan, is about restoring your IT systems and operations as efficiently as possible following a disaster. DR includes the backup systems and IT contingency methods for your organization’s critical functions and applications.
The objective is to minimize business downtime and reclaim access to your vital IT infrastructure and operations – including data, hardware, software, networking equipment, power, and connectivity – so you can get back up and running.
Where BC and DR overlap – and where they don’t
While DR is a subset of BC, there are times when it can – and should – be used without activating your entire BC plan.
If you experience a power outage, for example, and you have a reliable DR plan in place, you can fail over to your secondary site and be up and running with little or no disruption to your internal and external users. In such cases, you wouldn’t need to invoke your entire BC plan.
BC can also act independently of DR, as long as the event hasn’t impacted your IT infrastructure. For instance, if your organization is facing a public relations crisis, you need to get out in front of it by communicating statements to both internal and external stakeholders. But if there’s nothing wrong with your IT infrastructure, you’d only execute your BC plan.
Of course, your BC and DR plans often overlap. For example, if a wildfire takes out your data center, you need to enact your BC plan to communicate with those who’ve been affected and provide updates to your employees, customers, vendors, etc. But you must also invoke your DR plan to fix the affected infrastructure or fail over to your secondary site.
Planning for before, during, and after an event
BC is about more than just being prepared for an event; it’s about having plans in place for before, during, and after a disruption.
Suppose you’re hit with a cyberattack – you invoke your DR plan and quickly recover all your data. While your DR may have been successful, your BC plan must account for the aftermath of the event – which is often more important. The aftermath often revolves around communication.
Eventually, the news that your organization was hit with a cyberattack will leak. How will you respond, and who will deliver the message? How will you convey the lessons learned to regain customer and shareholder confidence?
Your DR may end when you fail over and fail back following a disaster, but your BC encompasses the entire spectrum of an event.
